3 ms·
Have they added lz4 and xz as well?
by xxpor 3y ago
Have they added lz4 and xz as well?
- jandrese 3y agoPlease, not even Linux distros add those by default yet. Microsoft won't consider it until at least 2030.
- jsheard 3y agoI don't have a preview channel install handy to check, but they're using libarchive so here's the full list assuming they expose everything it supports: https://github.com/libarchive/libarchive#supported-formats https://github.com/libarchive/libarchive#supported-formats edit: amended my last reply, Microsofts latest blog post says that XZ and Zstd are also supported.
- lostmsu 3y agoGreat, a new attack vector. Don't get me wrong, I love that they add support for more open source formats, but decompressors (especially written in C) are one of the most common sources of bugs basically everywhere. I wish they would sandbox it, but they probably won't.
- deleted 3y ago[deleted]
- jsheard 3y agoHaving the decompressor updated automatically by Windows Update is a significant step up from the current status quo of installing WinRAR or 7zip once and then usually never updating it for years because it has to be done manually. Microsoft will probably have more diligence in hardening the binaries than 7zip too, which resisted enabling basic exploit mitigations like DEP and ASLR until 2018 and still doesn't enable the more advanced MSVC mitigations as far as I'm aware. There's no excuse for that in an application that's expected to handle untrusted files.
- tssva 3y agoThis is implemented via libarchive which has actually shipped along with bsdtar for years now in Windows. They are just adding Windows explorer support for them.
- MikusR 3y agoCovered by Microsoft Bug Bounty Program